diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2009-05-20 11:47:37 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2009-07-30 09:44:33 +1000 |
| commit | 6d43a45b99e07325c74cbe1d20b04094ba99950d (patch) | |
| tree | e60d0543d566e6f098b0c09cc3d499a18c0c964b | |
| parent | 40d3ad3ac00fc21f2561c906d1246648a9f74087 (diff) | |
| download | xorg-driver-xf86-input-evdev-6d43a45b99e07325c74cbe1d20b04094ba99950d.tar.gz | |
Up the number of button labels atoms to EVDEV_MAXBUTTONS.
Button labels would smash memory if the device had less than 4 buttons and
did not advertise a wheel event. In this case the hard-coded wheel button
labels would write past the atoms[] boundary.
Potential memory smash if a device had a BTN_LEFT and BTN_0, since the
latter would map to 8, regardless of the the number of actual buttons
(same with BTN_MIDDLE and BTN_1 or BTN_RIGHT and BTN_2).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 33cc112ca1af377a85cfeb05dfb72f07d3850a95)
| -rw-r--r-- | src/evdev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/evdev.c b/src/evdev.c index fc4832b..80ba276 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -2028,12 +2028,12 @@ EvdevInitProperty(DeviceIntPtr dev) /* Button labelling */ if ((pEvdev->buttons > 0) && (prop_btn_label = XIGetKnownProperty(BTN_LABEL_PROP))) { - Atom atom, atoms[pEvdev->buttons]; + Atom atom, atoms[EVDEV_MAXBUTTONS]; int button, bmap; /* First, make sure all atoms are initialized */ atom = XIGetKnownProperty(BTN_LABEL_PROP_BTN_UNKNOWN); - for (button = 0; button < pEvdev->buttons; button++) + for (button = 0; button < ArrayLength(atoms); button++) atoms[button] = atom; for (button = BTN_MISC; button < BTN_JOYSTICK; button++) |